Help needed PC keeps rebooting



Paul Kelly
07-10-2005, 02:04 AM
Just wondering if some kind person could help me out. My pc keeps freezing
and the rebooting itself and i get the following message


A problem has been detected and windows has been shutdown to prevent damage
to your computer.

DRIVER_IRQL_NOT_LESS_OR_EQUAL

If this is the first time you've seen this stop error screen, restart your
computer. If this screen appears again, follow these
steps:

Check to make sure any new hardware or software is properly installed. If
this is a new installation, ask your hardware or software
manufacturer for any windows updates you might need.

If problems continue, disable or remove any newly installed hardware or
software. Disable BIOS memory options such as caching or shadowing.
If you need to use safemode to remove or disable components, restart your
computer, press F8 to select Advanced start-up options, and then select safe
mode.


Technical information


*** STOP: 0x000000D1 (0X00000400, 0X00000002, 0X00000000, 0XFC347A96)


*** NDIS.sys - Address FC347A96 base at FC32B000, Datastamp 41107ec3


Begining dump of physical memory
Physical memory dump complete
Contact you system administrator or technical support group for further
assistance.

___________________________________________________________________________

I don't have the best pc in the world I know and here are my specs
Windows xp pro
Pentium 3
1Ghz
128mb ram.

I've just had a fresh install done to see if that would fix the problem but
it hasn't.

Thanks
Paul (uk)
*remove NOSPAM to reply

Maurice N ~ MVP
07-10-2005, 02:04 AM
See the Aumha page on Windows 5x Stop codes. Scroll down to section on 000000D1
http://aumha.org/win5/kbestop.php#0xd1

http://aumha.org/win5/kbestop.htm

See also http://msdn.microsoft.com/library/default.asp?url=/library/en-us/w2kmsgs/6077.asp
--
Maurice N
MVP Windows - Shell / User
-----

"Paul Kelly" wrote
> Just wondering if some kind person could help me out. My pc keeps freezing
> and the rebooting itself and i get the following message
>
>
> A problem has been detected and windows has been shutdown to prevent damage
> to your computer.
>
> DRIVER_IRQL_NOT_LESS_OR_EQUAL
>
> If this is the first time you've seen this stop error screen, restart your
> computer. If this screen appears again, follow these
> steps:
>
> Check to make sure any new hardware or software is properly installed. If
> this is a new installation, ask your hardware or software
> manufacturer for any windows updates you might need.
>
> If problems continue, disable or remove any newly installed hardware or
> software. Disable BIOS memory options such as caching or shadowing.
> If you need to use safemode to remove or disable components, restart your
> computer, press F8 to select Advanced start-up options, and then select safe
> mode.
>
>
> Technical information
>
>
> *** STOP: 0x000000D1 (0X00000400, 0X00000002, 0X00000000, 0XFC347A96)
>
>
> *** NDIS.sys - Address FC347A96 base at FC32B000, Datastamp 41107ec3
>
>
> Begining dump of physical memory
> Physical memory dump complete
> Contact you system administrator or technical support group for further
> assistance.
>
> ___________________________________________________________________________
>
> I don't have the best pc in the world I know and here are my specs
> Windows xp pro
> Pentium 3
> 1Ghz
> 128mb ram.
>
> I've just had a fresh install done to see if that would fix the problem but
> it hasn't.
>
> Thanks
> Paul (uk)
> *remove NOSPAM to reply

Joshua Smith [MSFT]
07-10-2005, 02:04 AM
Hi Paul,

To determine what driver is causing the problem I need you to enable driver
verifier.
Steps:
1) Windows Key + R
2) Type in 'verifier' and hit enter
3) Make sure 'Create Standard Setting' is selected and hit next
4) Click on 'Select all drivers installed on this computer' and hit Finish
5) Reboot

There is a possibility that your computer will crash on reboot. If this
occurs hit F8 when rebooting just before the windows logo screen and select
the safe mode boot option. Follow the same steps above but on step 4 choose
'Select driver names from a list'; hit next; check the box next to any
driver where the provider is not Microsoft; hit Finish; reboot.

This will slow the performance of you computer a little while enabled but
will hopefully catch the driver causing corruption. Next time you crash
the blue screen will hopefully say something like
"DRIVER_VERIFIER_DETECTED_VIOLATION". If this occurs please send the
corresponding minidump (by default it is at c:\windows\Minidump ) my way.
If you have any questions or I didn't explain something well enough don't
hesitate to e-mail me (remove "online") back. Good Luck,


Joshua Smith
OpenGL Test Lab
Microsoft
-----

Get Secure! www.microsoft.com/security

This posting is provided "AS IS" with no warranties, and confers no rights


"Paul Kelly" <pk001d3183NOSPAM@blueyonder.co.uk> wrote in message
news:UZOhe.54413$a9.1721@fe3.news.blueyonder.co.uk...
> Just wondering if some kind person could help me out. My pc keeps freezing
> and the rebooting itself and i get the following message
>
>
> A problem has been detected and windows has been shutdown to prevent
> damage to your computer.
>
> DRIVER_IRQL_NOT_LESS_OR_EQUAL
>
> If this is the first time you've seen this stop error screen, restart your
> computer. If this screen appears again, follow these
> steps:
>
> Check to make sure any new hardware or software is properly installed. If
> this is a new installation, ask your hardware or software
> manufacturer for any windows updates you might need.
>
> If problems continue, disable or remove any newly installed hardware or
> software. Disable BIOS memory options such as caching or shadowing.
> If you need to use safemode to remove or disable components, restart your
> computer, press F8 to select Advanced start-up options, and then select
> safe mode.
>
>
> Technical information
>
>
> *** STOP: 0x000000D1 (0X00000400, 0X00000002, 0X00000000, 0XFC347A96)
>
>
> *** NDIS.sys - Address FC347A96 base at FC32B000, Datastamp 41107ec3
>
>
> Begining dump of physical memory
> Physical memory dump complete
> Contact you system administrator or technical support group for further
> assistance.
>
> ___________________________________________________________________________
>
> I don't have the best pc in the world I know and here are my specs
> Windows xp pro
> Pentium 3
> 1Ghz
> 128mb ram.
>
> I've just had a fresh install done to see if that would fix the problem
> but it hasn't.
>
> Thanks
> Paul (uk)
> *remove NOSPAM to reply
>
>
>

Bob Davis
07-10-2005, 02:11 AM
"Paul Kelly" <pk001d3183NOSPAM@blueyonder.co.uk> wrote in message
news:UZOhe.54413$a9.1721@fe3.news.blueyonder.co.uk...
> Just wondering if some kind person could help me out. My pc keeps freezing
> and the rebooting itself and i get the following message
>
>
> A problem has been detected and windows has been shutdown to prevent
> damage to your computer.
>
> DRIVER_IRQL_NOT_LESS_OR_EQUAL
>
> If this is the first time you've seen this stop error screen, restart your
> computer. If this screen appears again, follow these
> steps:
>
> Check to make sure any new hardware or software is properly installed. If
> this is a new installation, ask your hardware or software
> manufacturer for any windows updates you might need.
>
> If problems continue, disable or remove any newly installed hardware or
> software. Disable BIOS memory options such as caching or shadowing.
> If you need to use safemode to remove or disable components, restart your
> computer, press F8 to select Advanced start-up options, and then select
> safe mode.
>
>
> Technical information
>
>
> *** STOP: 0x000000D1 (0X00000400, 0X00000002, 0X00000000, 0XFC347A96)
>
>
> *** NDIS.sys - Address FC347A96 base at FC32B000, Datastamp 41107ec3
>
>
> Begining dump of physical memory
> Physical memory dump complete
> Contact you system administrator or technical support group for further
> assistance.

I just finished struggling for three days on this STOP error, although with
different parameters. You're lucky in that (1) the errant driver is
identified (NDIS.SYS) and (2) Joshua (from MS) has offered his services. I
didn't have either luxury.

NDIS.SYS is apparently a NIC driver, so you might start with updating this
driver. My BSOD did not ID the driver, and I had to find it by search and
destroy methods, a painstaking effort. I isolated it as an CD-ROM driver
from a very old copy of MusicMatch, which after uninstalling seems to have
fixed the problem. Running Verify crashed the system like Joshua mentioned
as a possibility, but I didn't go further except to ID the unsigned drivers.
Of the 10 or so listed, the MM driver was the only one recently installed,
which made it the most glaring suspect.

I never could figure out how to analyze the info imbedded in the DMP files
generated by the dump, and still would like to learn more about it. If
anyone can shed any light on this, please reply.

Bob Davis
07-10-2005, 02:11 AM
"Joshua Smith [MSFT]" <joshsm@online.microsoft.com> wrote in message
news:uci%231siWFHA.2648@TK2MSFTNGP15.phx.gbl...

> To determine what driver is causing the problem I need you to enable
> driver verifier.
> Steps:
> 1) Windows Key + R
> 2) Type in 'verifier' and hit enter
> 3) Make sure 'Create Standard Setting' is selected and hit next
> 4) Click on 'Select all drivers installed on this computer' and hit Finish
> 5) Reboot
>
> There is a possibility that your computer will crash on reboot. If this
> occurs hit F8 when rebooting just before the windows logo screen and
> select the safe mode boot option. Follow the same steps above but on step
> 4 choose 'Select driver names from a list'; hit next; check the box next
> to any driver where the provider is not Microsoft; hit Finish; reboot.
>
> This will slow the performance of you computer a little while enabled but
> will hopefully catch the driver causing corruption. Next time you crash
> the blue screen will hopefully say something like
> "DRIVER_VERIFIER_DETECTED_VIOLATION". If this occurs please send the
> corresponding minidump (by default it is at c:\windows\Minidump ) my way.
> If you have any questions or I didn't explain something well enough don't
> hesitate to e-mail me (remove "online") back. Good Luck,
>
>
> Joshua Smith
> OpenGL Test Lab
> Microsoft

Joshua, I wish I had access to your offer three days ago when I was
struggling with this problem. Unlike the OP, my STOP error did not list the
offending driver, although it has been tentatively ID'd and deleted by
uninstalling the associated program. The unrepeatable and sporadic BSOD was
difficult to analyze, and it would be nice to have access to a way to look
into the DMP file generated by the dump. What is the best way to do this?
I spent three days just trying to ID the presumed offending driver
(mxlw2k.sys), and I'm 90% sure I have it fixed.

I never got as far as the "DRIVER_VERIFIER_DETECTED_VIOLATION" BSOD you
describe, but did get two crashes after Verifier was run, every time I tried
to lauch XP Pro. My solution was to hit f8 and use the
last-known-good-configuration option, which put the system back the day
before.

At that point I looked at the list of 10 unsigned drivers and saw that only
one had been on the machine for less than one month. When I unistalled the
associated program (a very old copy of MusicMatch) the problem seems to have
gone away. It was a CD-ROM driver and the BSOD only occurred when accessing
that drive.

I have some DMP files generated by the various BSOD's experienced. Would it
be useful to have you look at any of these? I would like some verification
that the driver I unistalled is the true offender. TIA.

Joshua Smith [MSFT]
07-10-2005, 02:12 AM
Hi Bob,

Sorry to hear of your troubles. Usually dumps are pretty straight
forward when you get them figured out. You can get tools for debugging here:
http://www.microsoft.com/whdc/ddk/debugging

There is a TON of info on debugging up there for you if you ever have lots
of time to kill. :) I'd suggest using the WinDBG debugger. You can drag and
drop dmp files into it when it is running and it will open them for you.
Then just wait for the output to finish with the loading information and
then type "!analyze -v" (minus quotes) into the command area near the bottom
where it says kd>. Most of the time, if it is a dmp generated by Driver
Verifier, you willl get output that indicated the offending module, usually
a sys file. If it is listing something like ntoskrnl.exe or other kernel
files than it is probably a more complicated issue.


Joshua Smith
OpenGL Test Lab
Microsoft
-----

Get Secure! www.microsoft.com/security

This posting is provided "AS IS" with no warranties, and confers no rights

"Bob Davis" <iclicknix@cox.net> wrote in message
news:2l5le.23488$iU.10806@lakeread05...
>
> "Joshua Smith [MSFT]" <joshsm@online.microsoft.com> wrote in message
> news:uci%231siWFHA.2648@TK2MSFTNGP15.phx.gbl...
>
>> To determine what driver is causing the problem I need you to enable
>> driver verifier.
>> Steps:
>> 1) Windows Key + R
>> 2) Type in 'verifier' and hit enter
>> 3) Make sure 'Create Standard Setting' is selected and hit next
>> 4) Click on 'Select all drivers installed on this computer' and hit
>> Finish
>> 5) Reboot
>>
>> There is a possibility that your computer will crash on reboot. If this
>> occurs hit F8 when rebooting just before the windows logo screen and
>> select the safe mode boot option. Follow the same steps above but on
>> step 4 choose 'Select driver names from a list'; hit next; check the box
>> next to any driver where the provider is not Microsoft; hit Finish;
>> reboot.
>>
>> This will slow the performance of you computer a little while enabled but
>> will hopefully catch the driver causing corruption. Next time you crash
>> the blue screen will hopefully say something like
>> "DRIVER_VERIFIER_DETECTED_VIOLATION". If this occurs please send the
>> corresponding minidump (by default it is at c:\windows\Minidump ) my way.
>> If you have any questions or I didn't explain something well enough don't
>> hesitate to e-mail me (remove "online") back. Good Luck,
>>
>>
>> Joshua Smith
>> OpenGL Test Lab
>> Microsoft
>
> Joshua, I wish I had access to your offer three days ago when I was
> struggling with this problem. Unlike the OP, my STOP error did not list
> the offending driver, although it has been tentatively ID'd and deleted by
> uninstalling the associated program. The unrepeatable and sporadic BSOD
> was difficult to analyze, and it would be nice to have access to a way to
> look into the DMP file generated by the dump. What is the best way to do
> this? I spent three days just trying to ID the presumed offending driver
> (mxlw2k.sys), and I'm 90% sure I have it fixed.
>
> I never got as far as the "DRIVER_VERIFIER_DETECTED_VIOLATION" BSOD you
> describe, but did get two crashes after Verifier was run, every time I
> tried to lauch XP Pro. My solution was to hit f8 and use the
> last-known-good-configuration option, which put the system back the day
> before.
>
> At that point I looked at the list of 10 unsigned drivers and saw that
> only one had been on the machine for less than one month. When I
> unistalled the associated program (a very old copy of MusicMatch) the
> problem seems to have gone away. It was a CD-ROM driver and the BSOD only
> occurred when accessing that drive.
>
> I have some DMP files generated by the various BSOD's experienced. Would
> it be useful to have you look at any of these? I would like some
> verification that the driver I unistalled is the true offender. TIA.
>
>


Help needed PC keeps rebooting